Security audit

ts-prompt-optimizer

Security checks for vulnerabilities and agentic risk

Overview

This is a real prompt-optimization skill, but it stores and exposes prompts and API keys in ways users should review before installing.

Install only if you are comfortable with local prompt-history retention and manual credential hygiene. Prefer keeping API keys in environment variables or an OS secret store, avoid running config show/get with real keys set, review ~/.openclaw and shell startup files after setup, and do not use it for confidential prompts unless history retention is disabled or cleaned regularly.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (37)

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The CLI includes `show` and `get` commands that print the full loaded model configuration as JSON. Because `load_config()` resolves environment variables into in-memory `api_key` fields first, these commands can directly expose live API keys to stdout, shell history capture, logs, terminal recording, or other local observers. In a prompt-optimization skill, revealing secrets is unnecessary and materially increases risk.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The helper method returns raw API keys from the in-memory configuration, enabling any caller in the skill to retrieve secrets directly. For a prompt-optimization skill, broad secret exposure is unnecessary and increases the risk of accidental logging, disclosure through downstream code, or misuse by other components.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The CLI 'show' and 'get' paths print full configuration objects after environment-variable resolution, which can include live API keys. This creates a direct secret disclosure channel to terminal output, logs, shells with history capture, remote sessions, or any supervising agent framework collecting stdout.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The wizard persists API keys into shell startup files like .bashrc and .zshrc, expanding secret exposure beyond the application's own configuration scope. This broad persistence can leak credentials to other processes, backups, shell history workflows, or users with access to the account, and it exceeds what a prompt-optimizer setup helper strictly needs to do.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The code presents a connection test as successful without performing any real API validation, which can mislead users into trusting an invalid or misconfigured setup. In a security-sensitive configuration flow involving credentials, deceptive success signals can delay detection of broken auth, cause unsafe troubleshooting steps, and undermine user trust.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The optimizer maintains persistent 'memory' files and automatically records user inputs and generated prompts, which goes beyond a narrowly-scoped prompt optimization function and creates a privacy/security risk. Because prompts often contain API keys, proprietary code, internal instructions, or personal data, silent retention materially increases exposure if the host is multi-user, backed up, synced, or later inspected.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The feedback-learning feature persistently stores original inputs, optimized outputs, feedback, and notes, expanding the skill into local data collection without strong justification or safeguards. This is dangerous because user notes and feedback frequently contain sensitive context, and long-term storage increases the blast radius of accidental disclosure.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script reads API keys from environment variables and writes them into a persistent YAML file under the user's home directory. Persisting credentials in plaintext expands their exposure surface to local compromise, backup leakage, accidental sharing, and later misuse, especially since a prompt-optimization skill does not clearly require credential installation behavior.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill is presented as a prompt optimizer, but this script primarily performs local installation and writes personalized configuration containing credential material. This capability mismatch is dangerous because users may grant trust under a benign description while the skill performs higher-risk setup actions they did not reasonably expect.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The test script explicitly inspects persistent history and preferences files, confirming the skill records and reads user-related data outside the core prompt-optimization behavior described in the metadata. Even though this is a test file, validating such persistence normalizes collection of user interaction history and can expose sensitive prompts or preferences if those files are stored insecurely or accessed unexpectedly.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The code path under test demonstrates capability for recording and reading optimization history and user preferences, which is a form of data collection not justified by the stated description of a prompt optimizer. Prompt histories can contain confidential inputs, business data, or personal information, so retaining and re-reading them increases privacy and data exposure risk.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The `show` and `get` commands print raw configuration data to stdout, and this configuration likely includes sensitive provider settings such as API keys or other secrets. Exposing full config contents exceeds the stated prompt-optimization purpose and can leak credentials to local users, shell history, logs, CI output, or calling tools that capture stdout.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The configuration-dumping functionality is a genuine information exposure risk because it provides a direct path to disclose internal model configuration that is unrelated to the advertised optimizer behavior. In an agent-skill context, extra data-exfiltration features are especially suspicious because they may surface secrets from the host environment or the skill's persisted config.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The description states the skill will automatically supplement prompts with conversation history, user preferences, and background assumptions, but it does not warn users that potentially sensitive contextual data may be incorporated into prompts. In a prompt-optimization skill, this can lead to unintended disclosure of private or confidential information to downstream models or logs, especially when combined with external model routing.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The file advertises multi-model routing and support for multiple AI providers, but does not clearly disclose that user prompts may be transmitted to third-party services. This creates a real privacy and data-governance risk because users may assume processing is local or confined to a single provider when their inputs could be shared externally.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The guide documents prefix-based triggering but does not define clear activation boundaries, precedence, or exclusion conditions. In an agent skill, ambiguous trigger rules can cause the optimizer to activate on unintended inputs, which may reroute user content through additional processing paths and lead to prompt confusion, unintended behavior, or accidental handling of sensitive data.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Saying the skill supports 'multiple prefixes' without enumerating the complete allowed set creates uncertainty about when the skill will fire. This ambiguity increases the risk of overbroad interception of user prompts, accidental invocation, and inconsistent behavior across environments or implementations.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation advertises multi-model API support but does not disclose that user prompts or related context may be transmitted to external providers. This is a real security and privacy concern because users and operators may unknowingly expose sensitive prompts, proprietary data, or personal information to third-party services.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The release notes describe personalized optimization based on usage habits, learning history, dialogue context, and stored feedback, plus external model/API routing, but provide no disclosure of what data is collected, where it is sent, how long it is retained, or how users can opt out. In a skill that explicitly stores history and preferences and may transmit prompts to third-party model providers, this omission creates a real privacy and compliance risk because users may unknowingly expose sensitive prompt content and behavioral data.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill routes user prompts to external model providers, but the documentation does not clearly warn that prompt contents and potentially conversation-derived context may leave the local environment. That omission can lead users to submit sensitive data under the false assumption that optimization is local-only.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation states that optimization history and feedback are persistently recorded, but it does not provide a clear warning about retention, storage location, or duration. This creates a privacy risk because user tasks, preferences, and feedback may accumulate locally and later be reused or exposed without informed consent.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: This file stores raw user inputs and their optimized prompts in a persistent history log, and the examples show potentially identifying or business-sensitive requests being retained without any notice, minimization, redaction, or consent indication. In a prompt-optimizer skill, this increases the chance of inadvertent exposure of confidential user data through local files, future model context, backups, or logs.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The `show` command prints `config_manager.load_config()` and the `get` command prints a selected model config, both after environment-variable resolution has injected `api_key` values. This leaks credentials without masking or warning, making accidental disclosure very likely during normal use, especially in shared terminals, logs, screenshots, or support output.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: Configuration display commands expose sensitive values without masking, confirmation, or warning, making accidental disclosure highly likely during normal debugging or support use. Because the config is resolved before display, users may reveal environment-sourced credentials they did not realize were embedded in output.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The wizard modifies persistent user shell initialization files without an upfront, explicit warning that it will alter login environment configuration and store API secrets there. Silent or under-disclosed persistence of credentials is dangerous because users may not understand the scope, longevity, or side effects of the change.

Static analysis

No suspicious patterns detected.